# Does the new LambdaMOO core support Web?

Gustavo Glusman (bmgustav@bioinformatics.weizmann.ac.il)
Sun, 14 Apr 1996 06:04:35 PDT

- Messages sorted by:[ date ][ thread ][ subject ][ author ]

    >I had written:
    >> obviously wrong. Arguably MCP was 'bad'

    Rog wondered:
    >?? MPL

    Jay added:
    >I assume you mean the out of band handling required for inbound
    >MCP....anyway, it's still a cost/benefit analysis between
    >incompatibility and security and convenience and etc.

    Sorry, my mistake. For some unfathomable reason my brain keeps mixing the
    acronyms 'MPL' and 'MCP'...

    > (3) If you've got FUP, you now have a server that can do arbitrary
    >things to your file system.
    >
    >This is not a comment on the reliability of FUP;

    Well, FUP is supposed to do 'arbitrary' things to your filesystem, *within
    limits*. We think the limits we set are good enough. Comments are welcome.

    >in fact, I'd have to
    >guess that FUP is pretty reliable by now (though I have no personal
    >experience with it myself).  The point is that you now have a situation
    >where your wizards can write to your file system.  Whether this is an
    >issue depends on who your wizards are, the relative values of your DB
    >and your filesystem, and in the case of non-local ordinary-players, how
    >confident you are in the security of your DB.
    >
    >Most MOOs I know about have non-local wizards, and the filesystem is
    >usually worth more than any MOO db.

    This is all very correct, but (as you say) relevant only based on guesses
    and lack of direct experience with the software.
    I know it is a matter of trust, but just think about how many thousands of
    people are willing to ftp an 'unmodified package' of the MOO server, and go
    ahead and compile it and run it, without putting much thought to the fact
    that it *could* also do arbitrary things to their filesystem and OS, either
    by programming error or by malice of anyone that had access to the code
    before it was compiled.
    People will blindly trust any code that seems to come directly from Pavel.
    Code from anyone else will always be 'some random hack'. (except for the
    next maintainer(s), of course)
    Just keep in mind that checking whether FUP is doing what it is supposed to
    do, is much easier than checking whether the rest of the unmodified MOO
    server is actually doing what it is supposed to do.

    >Perhaps some form of FUP option will indeed make it into a future server
    >release, but you can bet (assuming the new maintainer has any sense)
    >that it's going to carry at least as big a warning around it as #define
    >OUTBOUND_NETWORK does now.

    Feel free not to install FUP. Feel free not to enable filerun(). There are
    enough warnings.

    >My choice of words, "less good" rather than "bad", was quite deliberate.
    > Depending on who you are, what you're doing with your MOO, what your
    >network situation is, etc... the use of FUP, raw DB manipulations, and
    >server hacks indeed may not actually be Bad, ...

    And it might actually turn out to be Very Good.

    -------------------------------------------------------------
    Gustavo Glusman               Founder/administrator of BioMOO
    -- Gustavo@bioinformatics.weizmann.ac.il
    -- http://bioinformatics.weizmann.ac.il/Gustavo
    -- BioMOO: telnet bioinformatics.weizmann.ac.il 8888
               WWW:   http://bioinfo.weizmann.ac.il/BioMOO